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Abstract  -  This  paper  presents  an  image  secret 
sharing  method  which  essentially  incorporates  two 
k-out-of-n  secret  sharing  schemes:  i)  Shamir’s  se¬ 
cret  sharing  scheme  and  ii)  matrix  projection  secret 
sharing  scheme.  The  technique  allows  a  secret  im¬ 
age  to  be  divided  as  n  image  shares  so  that:  i)  any  k 
image  shares  (k  <  n)  can  be  used  to  reconstruct  the 
secret  image  in  lossless  manner  and  ii)  any  (k  —  1)  or 
fewer  image  shares  cannot  get  sufficient  information 
to  reveal  the  secret  image.  It  is  an  effective,  reliable 
and  secure  method  to  prevent  the  secret  image  from 
being  lost,  stolen  or  corrupted.  In  comparison  with 
other  image  secret  sharing  methods,  this  approach’s 
advantages  are  its  large  compression  rate  on  the  size 
of  the  image  shares,  its  strong  protection  of  the  se¬ 
cret  image  and  its  ability  for  realtime  processing. 

Keywords:  image  processing,  secret  sharing,  matrix  pro¬ 
jection. 

1  Introduction 

The  effective  and  secure  protections  of  sensitive  infor¬ 
mation  [18]  are  primary  concerns  in  commercial,  med¬ 
ical  and  military  systems  ( e.g .  communication  systems 
or  network  storage  systems) .  Needless  to  say,  it  is  also 
important  for  an  information  fusion  process  to  ensure 
data  is  not  being  tampered.  Encryption  methods  are 
one  of  the  popular  approaches  to  ensure  the  integrity 
and  secrecy  of  the  protected  information.  However, 
one  of  the  critical  vulnerabilities  of  encryption  tech¬ 
niques  is  single-point-failure.  For  example,  the  secret 
information  cannot  be  recovered  if  the  decryption  key 
is  lost  or  the  encrypted  content  is  corrupted  during  the 
transmission.  To  address  these  reliability  problems,  in 
particular  for  large  information  content  items  such  as 
secret  images  (say  satellite  photos  or  medical  images), 
an  image  secret  sharing  scheme  (SSS)  is  a  good  alter¬ 
native  to  remedy  such  vulnerabilities. 

Blakley  [4,11]  and  Shamir  [16]  invented  two  ( k ,  n ) 
threshold-based  SSS  independently  in  1979.  The  gen¬ 
eral  idea  behind  “secret  sharing”  is  to  distribute  a  se¬ 
cret  (e.g.,  encryption/decryption  key)  to  n  different 
participants  so  that  any  k  participants  can  reconstruct 
the  secret,  and  any  ( k  —  1)  or  less  participants  can¬ 
not  reveal  anything  about  the  secret.  Karnin  et  al.  [9] 
suggested  the  concept  of  perfect  secret  sharing  (PSS) 
where  zero  information  of  the  secret  is  revealed  for  an 


unqualified  group  of  (k  —  1)  or  fewer  members.  Appar¬ 
ently,  there  is  a  subtle  difference  between  the  unquali¬ 
fied  group  cannot  obtain  any  information  about  the  se¬ 
cret  and  the  unqualified  group  cannot  reconstruct  the 
secret  with  some  information.  For  example,  although 
an  unqualified  group  may  know  information  about  the 
secret  as  an  even  number,  the  group  still  cannot  dis¬ 
cover  the  exact  value  of  the  secret.  Specifically,  Karnin 
et  al.  used  a  term  referred  as  information  entropy  (a 
measurement  of  the  uncertainty  of  the  secret) ,  denoted 
as  H(s)  where  s  is  a  secret  shared  among  n  partic¬ 
ipants.  The  claim  of  PSS  schemes  must  satisfy  the 
following: 

1.  a  qualified  coalition  of  k  or  more  participants,  C 
can  reconstruct  the  secret(s),  s: 

H(s\C)  =  0  V|C|  >  k, 

2.  an  unqualified  coalition  of  ( k  —  1)  or  few  partici¬ 
pants,  C  has  no  information  about  the  secret(s), 
s: 

H(s\C)=H(s)  V|C|<fc. 

For  these  requirements  in  PSS  schemes,  a  secret  has 
zero  uncertainty  if  the  secret  can  be  discovered  by  k 
or  more  participants.  On  the  contrary,  the  secret,  in 
PSS  schemes,  remain  the  same  uncertainty  for  ( k  —  1) 
or  fewer  members.  Therefore,  there  is  no  information 
exposed  to  the  ( k  —  1)  or  fewer  members. 

When  exposed  information  is  proportional  to  the 
size  of  the  unqualified  coalition,  these  types  of  SSS  are 
referred  to  ramp  secret  sharing  (RSS)  [10,14,15,17]. 
Various  research  papers  are  devoted  on  the  topic  of 
PSS  schemes  [1,3]  and  RSS  schemes  [5,7,8]. 

Naor  and  Shamir  [12,13]  extended  the  secret  sharing 
concept  into  image  research,  and  referred  it  as  visual 
cryptography.  Visual  cryptography  is  a  PSS  scheme, 
and  requires  stacking  any  k  image  shares  (or  shadow 
images)  to  show  the  original  image  without  any  crypto¬ 
graphic  computation.  The  disadvantages  are:  i)  image 
shares  have  larger  image  size  compared  to  the  size  of 
the  original  secret  image  and  ii)  the  contrast  ratio  in 
the  reconstructed  image  is  quite  poor.  A  better  im¬ 
age  secret  sharing  approach  was  presented  by  Thien 
and  Lin  [18].  With  some  cryptographic  computation, 
they  cleverly  used  Shamir’s  SSS  to  share  a  secret  im¬ 
age.  The  method  significantly  reduces  the  size  of  the 
image  shares  to  become  1/fc  of  the  size  of  the  secret 
image,  and  the  secret  image  can  be  reconstructed  with 
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good  quality.  A  drawback,  in  terms  of  security,  re¬ 
quires  that  the  image  is  permutated  by  a  key  before 
the  image  share  can  be  computed. 

We  propose  to  enhance  Thien  and  Lin’s  image  SSS 
by  incorporating  another  secret  sharing  method  -  ma¬ 
trix  projection  SSS.  The  size  of  image  shares  is  in¬ 
creased,  but  is  still  significantly  less  than  the  size  of  the 
secret  image.  However,  this  approach  provides  a  bet¬ 
ter  security  measure  to  protect  the  image  content  and 
an  adaptive  method  to  reconstruct  image  in  lossless 
manner.  This  method  also  allows  realtime  processing. 

The  rest  of  paper  is  organized  as  follows:  A  brief  re¬ 
view  is  given  in  about  section  2  secret  sharing  schemes 
including  matrix  projection  SSS  and  Thien  and  Lin’s 
image  SSS.  Our  technique  is  proposed  in  section  3  with 
its  advantages  and  the  conclusion  given  in  section  4. 

2  Review  of  Secret  Sharing 
Schemes 

We  describe  several  (fc,  n)  threshold-based  SSSs  and 
describe  how  a  secret  and  an  image  is  shared  among 
n  participants.  These  schemes  are  briefly  described  in 
this  section  with  their  interesting  features. 

2.1  Shamir’s  Secret  Sharing  Scheme 

Shamir  [16]  developed  the  idea  of  a  (k,  n)  threshold- 
based  secret  sharing  technique  (k  <  n).  The  tech¬ 
nique  allows  a  polynomial  function  of  order  (fc  —  1) 
constructed  as, 

f(x)  =  d0  +  d\x  +  d,2X2  +  . . .  +  dk-ixk~ 1  (mod  p), 

where  the  value  do  is  the  secret  and  p  is  a  prime  num¬ 
ber.  The  secret  shares  are  the  pairs  of  values  ( Xi,yi ) 
where  yi  =  f{xi),  l  <  i  <  n  and  0  <  X\  <  X2  ■  ■  ■  < 
xn  <  P  -  1- 

The  polynomial  function  f(x)  is  destroyed  after  each 
shareholder  possesses  a  pair  of  values  (xt,  yi)  so  that  no 
single  shareholder  knows  the  secret  value  do-  In  fact, 
no  groups  of  k  —  1  or  fewer  secret  shares  can  discover 
the  secret  do-  On  the  other  hand,  when  k  or  more  se¬ 
cret  shares  are  available,  then  we  may  set  at  least  k 
linear  equations  yi  =  f{xt)  for  the  unknown  d/  s.  The 
unique  solution  to  these  equations  shows  that  the  se¬ 
cret  value  do  can  be  easily  obtained  by  using  Lagrange 
interpolation  [16]. 

Shamir’s  SSS  is  regarded  as  a  PSS  scheme  because 
knowing  even  (fc  —  1)  linear  equations  doesn’t  expose 
any  information  about  the  secret. 

2.2  Thien  and  Lin’s  Image  Secret  Shar¬ 
ing  Scheme 

Thien  and  Lin  [18]  proposed  a  (k,  n )  threshold-based 
image  SSS  by  cleverly  using  Shamir’s  SSS  [16]  to  gen¬ 
erate  image  shares.  The  essential  idea  is  to  use  a  poly¬ 
nomial  function  of  order  (fc  —  1)  to  construct  n  image 
shares  from  an  l  x  l  pixels  secret  image  (denoted  as  I ) 
as, 


Sx{i,j)  =  I{ik  +  1,  j)  +  ■  ■  ■  + 

I(ik  +  k  —  1,  j)xk~x  (mod  p)  (1) 

where  0  <  i  <  |_|rj  and  1  <  j  <  l.  This  method  re¬ 
duces  the  size  of  image  shares  to  become  1/k  of  the 
size  of  the  secret  image.  Any  k  image  shares  are  able 
to  reconstruct  every  pixel  value  in  the  secret  image. 
Thien  and  Lin  also  provided  some  research  insights  for 
lossless  image  recovery  using  their  technique.  They 
further  introduced  the  possibility  of  a  steganography 
approach  [18, 19]  by  hiding  image  shares  into  host  im¬ 
ages. 

An  example  of  (2,  4)  image  secret  share  construction 
process  is  illustrated  in  Figure  1  where  k  =  2  and  n  = 
4.  According  to  the  technique,  a  first  order  polynomial 


Figure  1:  Secret  Sharing  Process  for  Lena  Image 

function  can  be  created  as 

Sx(i,j)  =  (110  +  112x)  (mod  251)  (2) 

where  110  and  112  are  the  first  two  pixel  values  in  the 
Lena  image.  For  our  four  participants,  we  can  ran¬ 
domly  pick  four  x  values,  and  substitute  them  into  the 
polynomial  function  by  setting  p  value  to  be  251  which 
is  the  largest  prime  number  less  than  255  (maximum 
gray  image  value).  Four  shares  are  computed  as  (1, 
222),  (2,  83),  (3,  195)  and  (4,  56).  They  become  the 
first  pixel  in  four  image  shares.  The  second  pixel  is 
computed  in  the  same  manner  by  constructing  another 
first  order  polynomial  function  using  next  two  pixels  in 
the  Lena  image.  This  process  continues  until  all  pixels 
are  encoded.  Four  image  shares  are  the  bottom  right 
images  shown  in  Figure  1,  and  the  size  of  each  image 
share  is  half  (1/2)  size  of  the  original  image.  None  of 
the  image  shares  appear  to  reveal  information  about 
the  secret  image.  However,  the  pixel  values  in  a  nat¬ 
ural  image  are  not  random  because  the  neighboring 
pixels  often  have  equal  or  close  values.  It  is  evident 
that  the  first  two  pixel  values  (110  and  112)  are  very 
close  to  each  other.  That  creates  the  possibility  that 
one  image  secret  share  may  be  used  to  recover  the  se¬ 
cret  image  by  assuming  the  neighboring  pixels  have  the 
same  values  in  the  first  order  polynomial  function. 

Since  Thien  and  Lin’s  method  reduces  the  size  of 
image  shares  to  become  1/k  of  the  size  of  the  secret 
image,  the  scheme  cannot  be  qualified  as  a  “perfect” 
image  SSS  [6,9].  In  fact,  this  method  is  a  multiple- 
secret  “ramp”  SSS  [7].  In  other  words,  the  information 
about  the  secret  exposed  is  proportional  to  the  number 
of  shares  available  until  the  number  of  shares  becomes 


k  or  more.  In  addition,  the  pixel  values  in  a  natural 
image  are  not  random  because  the  neighboring  pixels 
often  have  equal  or  close  values.  A  secret  image  can  be 
possibly  recovered  from  less  than  k  image  shares  be¬ 
cause  neighboring  pixels  are  highly  correlated.  To  ad¬ 
dress  these  security  issues,  Thien  and  Lin  suggested  an 
idea  by  permutating  the  order  of  pixels  (with  a  permu¬ 
tation  key)  in  the  secret  image  before  the  image  shares 
are  computed.  Conversely,  the  secret  image  can  still  be 
reconstructed  from  any  k  image  shares  by  solving  the 
permutatecl  image  and  applying  inverse-permutation 
using  the  permutation  key.  Nevertheless,  the  permu¬ 
tation  key  becomes  the  single-point-failure  in  the  sys¬ 
tem  because  the  key  can  get  lost  or  corrupted.  This 
scheme  also  prevents  realtime  processing  because  the 
permuted  image  has  to  be  obtained  before  the  secret 
image  can  be  reconstructed. 

2.3  Matrix  Projection  Secret  Sharing 
Scheme 

Bai  [2]  developed  a  SSS  using  matrix  projection.  The 
idea  is  based  upon  the  invariance  property  of  matrix 
projection.  This  scheme  can  be  used  to  share  multiple 
secrets,  and  detail  of  the  scheme  can  be  found  in  [2]. 
Here,  we  briefly  describe  the  procedure  in  two  phases: 


To  construct  the  shares,  we  choose  a  4  x  2  random 
matrix  A  of  rank  2  that 


A  = 
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The  values  of  to  =  4  and  k  =  2  satisfy  the  condition  of 
secret  sharing  where  m  >  2  (k  —  1)  —  1.  Choose  n  =  4 
linearly  independent  vectors  as 
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Next  we  compute  i \  =  Axi  for  i  =  1, 2, 3, 4, 
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The  projection  matrix  S  is 


S  =  {A{AIA)~1A')  (mod  251) 
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•  Construction  of  Secret  Shares  from  secret  matrix 
S 

1.  Construct  a  random  m  x  k  matrix  A  of  rank 
k  where  m  >  2 {k  —  1)  —  1, 

2.  Choose  n  linearly  independent  k  x  1  random 
vectors 

3.  Calculate  share  =  {A  x  x^)  (mod  p)  for 
1  <  i  <n. 

4.  Compute  S  =  (A(A' A)~l A')  (mod  p ), 

5.  Solve  R  =  (S  —  S)  (mod  p), 

6.  Destroy  matrix  A,  XiS,  S,  S',  and 

7.  Distribute  n  shares  Vi  to  n  participants  and 
make  matrix  R  publicly  known. 

•  Secret  Reconstruction 

1.  Collect  k  shares  from  any  k  participants,  say 
the  shares  are  v\ ,  v2 , . . . ,  Vk  and  construct  a 
matrix  B  =  [v i  V2  ■  ■  •  vA . 

2.  Calculate  the  projection  matrix  S  = 
(B(B'B)~lB')  (mod  p), 

3.  Verify  that  tr(S)  =  k,  and 

4.  Compute  the  secret  S  =  (S  +  R  (mod  p). 


then  the  remainder  matrix  R  is  equal  to 


R  =  (S  -  S)  (mod  251) 
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The  matrix  R  is  made  public.  We  can  destroy  A,  Xi s, 
S  and  S,  then  we  distribute  three  vt  shares  to  three 
different  participants. 

When  a  coalition  of  two  participants  collaborate  to¬ 
gether,  they  can  form  a  matrix  B.  For  example,  these 
two  shares  are  v\  and  v 2  to  form  the  matrix  B  as 
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The  projection  matrix  S  is 


S  =  (B^B'B^B')  (mod  251) 


53 

87 

88 

175 

87 

137 

199 

100 

88 

199 

119 

46 

175 

100 

46 

195 

We  can  validate  that  tr  (§)  =  2  =  k.  The  secret  matrix 
S  is  obtained  by  remainder  matrix  R  and  the  projec¬ 
tion  matrix  S  as 


A  simple  (2,4)  threshold-based  example  is  shown 
for  p  =  251  and  the  secret  matrix 
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S=(R  +  S)  (mod  251) 
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The  reconstructed  matrix  is  same  as  secret  matrix,  and 
the  shares  are  1/m  of  the  size  of  the  secret  matrix  (for 


our  case,  it  is  1/4  because  m  =  4).  Obviously,  this 
shares  compression  ratio  can  be  further  increased  with 
a  larger  to  value.  According  to  [6,9],  the  scheme  is  not 
a  PSS,  rather,  this  method  was  proven  to  be  a  RSS 
scheme  [2].  Its  main  advantages  are  multiple  secrets 
sharing,  strong  protection  of  the  secrets  and  smaller 
size  for  the  secret  shares. 


3  Proposed  Method 

Among  several  interesting  properties  of  matrix  projec¬ 
tion  SSS,  an  image  application  can  be  easily  extended 
from  this  scheme’s  ability  to  share  multiple  secrets. 
The  pixels  in  an  image  can  be  regarded  as  matrix  el¬ 
ements.  Although  the  technique  is  not  a  PSS  scheme, 
it  has  strong  protection  of  the  secret  [2]  even  if  the  re¬ 
minder  matrix  R  is  made  public.  However,  matrix  R 
can  become  single-point-failure  if  it  is  corrupted  or  lost. 
To  overcome  this  problem,  we  propose  to  use  Thien  and 
Lin’s  method  (which  is  essentially  a  Shamir’s  SSS)  to 
share  the  remainder  matrix  R  without  any  permuta¬ 
tion.  As  we  discussed  in  section  2,  Thien  and  Lin’s 
method  cannot  protect  matrix  R  securely,  but  it  does 
not  affect  the  protection  capability  on  the  projection 
matrix. 

For  an  l  x  l  secret  image  with  intensity  level  as  I (i,j) 
where  1  <  i,j  <  l,  we  can  partition  the  secret  image  / 
as  non-overlapped  mxro  blocks.  It  procedures  roughly 
( \l/rn\ )2 3  blocks.  We  can  share  each  block  S  using  fol¬ 
lowing  scheme 

1.  construct  an  to  x  k  random  matrix  A  of  rank  k, 

2.  determine  its  projection  matrix  S  and  remainder 
matrix  R  =  S  —  S. 

3.  If  any  element  in  matrices  S  and  R  is  greater  than 
251,  go  back  to  step  1)  to  reconstruct  a  new  ran¬ 
dom  matrix  A.  Otherwise,  proceed  to  the  next 
step. 

4.  Choose  n  linearly  independent  k  x  1  random  vec¬ 
tors  Xi  and  n  distinct  values  ?y, 

5.  Calculate  share  V{  =  {A  x  a:*)  (mod  p)  for  1  <  i  < 
n. 


6.  Use  Thien  and  Lin’s  image  SSS  to  secretly  share 


the  matrix  R  as  a  G,  = 


for  g^’U)  —  I(tk  +  l,j)  +  ...  +  I(tk  +  k  — 
l,j)rt_1  mod  251  where  1  <  t  <  \^~\  and  1  < 

j  <  TO 


9 1 


*) 


(i) 

9-2 


(*) 

9\W 


7.  Each  image  share  Shi  is  the  combination  of  i \  and 

Gj. 

To  illustrate  this  method  in  a  (2, 4)  threshold-based 
image  SSS,  we  consider  a  more  specific  example  that  a 
secret  matrix  is  partitioned  from  a  large  image  where 


2  3  12 
5  4  6  1 
8  9  7  2 

3  4  12 


We  see  the  matrix  S  is  the  same  secret  matrix  shown 
in  section  2.  Hence,  we  can  use  the  same  secret  shares 
using  matrix  projection  SSS  where, 


v\ 


'27' 

'17 

'll 

'19' 

41 

21 

9 

25 

76 

.  v2  = 

36 

,V3  = 

12 

,  Vi  = 

44 

18 

8 

2 

10 

,  and 


the  remainder  matrix  R 


51 

84 

87 

173 

82 

133 

193 

99 

80 

190 

112 

44 

172 

96 

45 

193 

We  can  set  r,  =  i  for  i  =  1, 2, 3, 4,  and 


'116 

242' 

'32 

242' 

36 

210 

,  g2  = 

36 

210 

232 

95 

232 

95 

234 

13  _ 

234 

13 . 

'199 

147' 

'115 

225' 

21 

12 

,  g4  = 

139 

164 

103 

7 

164 

214 

42 

129 

197 

187 

Therefore,  the  image  shares  are  combined  as  Shi  = 
[iq  Gi]  for  i  —  1, 2, 3,4,  i.e. 
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,  Sh2  = 
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36 
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II 

-r 

-e 
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25 
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12 
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7 

44 
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2 

42 
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10 

197 

187 

The  image  shares  require  /  +  A  size  of  the  secret  im¬ 
age  (or  3/4  size  of  the  secret  image  because  k  =  2  and 
to  =  4).  We  use  the  same  process  for  (2,4)  threshold- 
based  image  SSS.  Four  image  shares  are  shown  in  Fig¬ 
ure  2,  and  the  reconstructed  Lena  image  is  shown  in 


image  share  1 


image  share  2 


image  share  3 


image  share  4 


Figure  2:  Image  Shares  for  Lena  Image 
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Figure  3:  Lossless  reconstructed  Lena  Image 

Figure  3.  As  we  can  see  from  these  figures,  the  size 
of  image  shares  is  significantly  less  than  the  size  of 
the  secret  image.  If  any  image  share  is  corrupted,  we 
can  get  the  secret  image  back  from  other  three  image 
shares.  In  fact,  any  block  or  blocks  of  one  image  share 
is  corrupted,  we  can  still  fully  recover  the  whole  se¬ 
cret  image  from  corrupted  blocks  in  other  three  image 
shares.  This  process  does  not  need  to  reprocess  the 
whole  image  as  Thien  and  Lin’s  method. 

4  Conclusion 

We  proposed  an  image  SSS  using  essentially  two  tech¬ 
niques:  i)  SSS  using  matrix  projection  and  ii)  Shamir’s 
SSS.  A  secret  image  can  be  successfully  reconstructed 
from  any  k  image  shares,  but  cannot  be  revealed  from 
any  (A  —  1)  or  fewer  image  shares  (due  to  RSS  scheme 
for  the  matrix  projection  method).  The  size  of  im¬ 
age  shares  is  smaller  than  the  size  of  the  secret  im¬ 
age.  Another  advantage  is  the  this  scheme  can  be  used 
in  almost  realtime  by  simultaneous  processing  smaller 
blocks  partitioned  from  the  secret  image.  For  all  these 
block  images,  we  can  parallel  process  the  generation  of 
image  shares  or  the  reconstruction  of  the  secret  image. 
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